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DETAILED ACTION 

Continued Examination Under 37 CFR 1.114 

1 . A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.114, and the fee set 
forth in 37 CFR 1 .17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 
07/07/2008 has been entered. 

Response to Amendment 

2. This office action is in response to amendment /reconsideration filed on 
07/07/2008, the amendment/reconsideration has been considered. Claims 36 and 41 
have been canceled, claims 43 and 44 have been newly added and therefore, claims 1- 
35, 37-40 and 42-44 are pending for examination, the rejection cited as stated below. 

Response to Arguments 

3. Applicant's arguments have been considered but are moot in view of the new 
ground(s) of rejection. 

Claim Objections 

4. Claim 43 recite, "Discovering a topology of notes in the SAN" to which examiner 
considers and "nodes" for examining purposes. 

5. The text of those sections of Title 35 U.S.C 1 03(a) is not included in this action 
can be found in a prior Office Action. 
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6. Claims 1-13, 17-30 and 34-37, 43-44 are rejected under 35 U.S.C. 103 (a) as 
being unpatentable over Weber ET al. (Pub. No.: US 2006/01 73992 A1 ), hereinafter 
"Weber" in view of Akagawa et al. (Pub. No.: 2004/0210791 A1), hereinafter "Akagawa" 
and further in view of Cooper et al. (Pub. No.: US 2004/0042470 A1 ), hereinafter 
"Cooper". 

7. Weber, Akagawa and Manghirmalani have been cited as prior arts in the last 
office action. The teachings that applicable are respectfully maintained and incorporated 
by reference as set forth in the last office action. 

8. As to claims 1 ,1 8,35 and 37, Weber discloses, the invention substantially, 
including, each status event having a corresponding event category and severity value 
(Weber, Abstract, where anomalies is a category and Fig. 10, Element-56c, [0195], 
where events has severity indicator/value); 

displaying a status array having a plurality of chart entries (Weber, Fig. 29, 
[0195]), each chart entry corresponding to alert messages of a particular event category 
(Weber, Fig. 29, [0195] where events are listed corresponding to the type of alert 
messages) and each chart entry having a node entry for each node having status 
attributable to the alert messages (Weber, Fig.29, [0195], where source is the node 
entry and action taken is status attributable to alert messages/anomalies as anomalies 
are any abnormal event occur in the network creates a log which can be interpret as 
alert messages); and 
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displaying, within at least one chart entry (Weber, Fig. 29), node entries having a 
status event associated with the event category for that chart entry (Weber, Fig. 29, 
where node have corresponding event category). 

Weber however, is silent on disclosing the invention in SAN. Akagawa however 
discloses the invention in SAN environment. 

Therefore, it would have been obvious to one ordinary skilled in the art at the 
time the invention was made to combine the teachings of Weber with the teachings of 
Akagawa in order to provide a system to correctly notify a fault, in case a fault has 
occurred in the volume, by using a host computer which can access the volumes as 
managed by a management computer that integrally manages a plurality of devices 
constituting a network. 

Weber and Akagawa however are silent on disclosing explicitly, "receiving alert 
messages corresponding to status events in the network" or "aggregating the alert 
messages according to event category and severity value to generate a category 
specific severity ranking of the alert messages" or "the node entries displayed in the 
chart entry according to the severity ranking and each node entry indicative of a severity 
scale of status for the corresponding effected node". 

Cooper however discloses, receiving alert messages corresponding to status 
events in the network (Cooper, [0423], where network monitor provides support for 
setting up alarms on connection by receiving a signal when specific event occur), 

aggregating the alert messages according to event category and severity value 
to generate a category specific severity ranking of the alert messages (Cooper, Fig. 22 
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and 23, where displayed is a chart entry as element 2202, containing status of the event 
as Fig. 23, element-2301, status, event category as type, the node entries as Fig.23, 
element-2301, srclP and severity as Fig. 22, element-2202, severity); 

the node entries displayed in the chart entry according to the severity ranking 
(Cooper, Fig. 22, element-2202, further clicking on view tab brings all the detailed 
information as further depicted in Fig.23) and each node entry indicative of a severity 
scale of status for the corresponding effected node (Cooper, Fig. 32, where displayed is 
a conformance fig with associated values and a chart with severity ranking, counts and 
overall percentage for particular event and a detail tab which brings up specific details). 

Therefore it would have been obvious to one of ordinary skilled in the art at the 
time the invention was made to combine the teachings of Weber, Akagawa with the 
teachings of Cooper in order to provide an apparatus for a network monitor internals 
mechanism, which serves to translate packet data into multiple concurrent streams of 
encoded network event data, to contribute to enterprise management, reporting, and 
global mechanisms for aggregating monitors at a centralized aggregation point, and to 
facilitate rate limiting techniques. 

9. As to claim 43, carry similar limitations as claims 1 , 1 8, 35 and 37 above and 
further limitation from claims 2, 5 and 1 1 have been incorporated herein and therefore is 
rejected under for same rationale, additionally, Cooper discloses, discovering a topology 
of nodes in the SAN (Cooper, Fig. 2 and 3, [0161], where topology is described in terms 
of nodes and policy); storing status events in an event repository (Cooper, [01 11], 
where network events and its dispositions are stored in a database). 
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10. As to claims 2 and 19, Weber, Akagawa and Cooper discloses the invention 
substantially as in parent claims 1 and 18, including, accumulating events of each of a 
plurality of severity levels (Weber, Fig. 29, Element-304, where percentage shows the 
accumulation of events by category), each severity level representing a range of 
severity values such that a given status event with a given severity value has 
corresponding severity level when the given severity value of the given status event is 
within a range of severity values for the corresponding severity level (Weber, Fig. 29, 
element-304, [0125] and [0129] where severity is displayed in %age which means there 
has to be a certain range/scale to measure the severity in %age for corresponding 
events, further critical or out of bound severity levels are calculated based on predefined 
threshold), wherein the severity scale for a node entry is an enumeration of events 
received for each of the plurality of severity levels within the severity ranking (Weber, 
Fig. 29 and Fig. 30, [0195], where displayed on user interface is severity levels, severity 
ranking and severity values are listed among corresponding events and categories) the 
severity ranking determined by the severity scale for each node entry, (Weber, Fig. 29, 
element-308, [0197] where top ten nodes are listed based on severity level ranking 
which is based on statistical measure); and 

displaying the enumeration of events received for each node entry within the at 
least one chart entry containing that node entry (Weber, Fig. 29 and Fig.30, [0195] and 
[0196], where user interface is displayed with all the events with their characterizations), 
the enumeration displayed in an order according to the severity ranking (Weber, Fig. 32, 
where enumeration is listed according to the severity ranking). 
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11. As to claims 3 and 20, Weber, Akagawa and Cooper discloses the invention 
substantially as in parent claims 2 and 19, including, wherein the enumeration is a 
histogram having a magnitude based on the severity scale and a quantity of events 
within each severity level within the severity ranking (Weber, Fig.29, [0195], where 
events listed in element-304 are translated into graph with listed attributes of the events 
described in parent claims 2 and 19 above). 

12. As to claims 4 and 21 are rejected for the same rationale applied to claims 3 and 
20 above, further Examiner takes the official notice that histograms can be displayed in 
many different shapes and colors and is well know technique in the art. 

1 3. As to claims 5 and 22, Weber, Akagawa and Cooper discloses the invention 
substantially as in parent claims 1 and 18, including, further including discovering a 
topology of nodes (Weber, [0004], where monitoring a network with established 
topology means discovering a topology of nodes), wherein the alert messages 
correspond to status events for each of a plurality of selected nodes in a selection tree 
(Weber, Fig. 30, [0198], where node statistics are displayed when user clicks on the line 
item in the user interface area of listed items) the selection tree indicative of the nodes 
(Weber, Fig.29, [0195]). Weber however is silent on disclosing the invention in SAN. 
Akagawa however, discloses the instant invention concept in SAN environment and it 
will be an obvious variation to combine the teachings of Weber with the teachings of 
Akagawa. 
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14. As to claims 6 and 23, Weber, Akagawa and Cooper discloses the invention 
substantially as in parent claims 1 and 18, including, further including filtering the status 
events to compute a subset of elected events (Weber, Fig. 12, [0083], where filtering is 
shown based on specific event), wherein the received events correspond to elected 
events determined in response to predetermined filtering logic at the agents processing 
the elected events (Weber, Fig. 12, [0084], where predetermined logic is defined for 
filtering). 

15. As to claims 7 and 24, Weber, Akagawa and Cooper discloses the invention 
substantially as in parent claims 1 and 18, including, wherein each chart entry has a 
magnitude axis (Weber, Fig. 29, [0195], where element-304 can be mapped into graph 
or histogram as depicted in the drawing which has x-axis and y-axis being magnitude), 
the magnitude axis indicative of a relative range of the quantity of status events within 
each of the severity levels corresponding to a plurality of node entries reflected in the 
chart entry (Weber, Fig. 29, [0195], where Y-axis shows the severity range of anomalies 
and X-axis shows the quantity/frequency of events). 

16. As to claims 8 and 25, Weber, Akagawa and Cooper discloses the invention 
substantially as in parent claims 1 and 18, including, wherein each chart entry has a 
manageable entity axis (Weber, Fig. 15, Nodes A, B and C can represent manageable 
entity axis), the manageable entity axis arranged, for each node, according to 
increasing severity scale denoting the severity ranking for each node included in the 
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chart entry (Weber, Fig. 30, [0198], where anomalies detected column represents the 
node and normal column represents the severity level which can also be interpret as 
ranking), and further comprising computing the severity scale for each node according 
to a predetermined severity metric (Weber, [0084], where calculation is made from 
predetermined parameters to determine the severity). 

1 7. As to claims 9-1 0 and 26-27, Weber, Akagawa and Cooper discloses the 
invention substantially as in parent claims 1 and 18, including, wherein the severity level 
corresponds to a threshold value, the threshold value identifying triggering of an event 
having the corresponding severity level (Weber, Fig. 29, [0195], where element-304 list 
the severity in percentage along with indication of low, medium and high which means 
there has to be a threshold set up for each indication to occur and this step can be 
repeated further within the group of anomalies). 

18. As to claims 1 1 and 28, Weber, Akagawa and Cooper discloses the invention 
substantially as in parent claims 10 and 27, including, further comprising processing and 
propagating the threshold values to remote agents (Weber, Abstract, where collecting 
data and statistical information and aggregating of anomalies obviously means there 
has to be remote agents and threshold values have been set for detection of events 
between host and remote computers on the network), the remote agents operable to 
analyze nodes and determine when a particular metric satisfying a triggering threshold 
is attained and generate the corresponding event (Weber, Abstract, again same 
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rationale can be given as host obviously has agent collecting information on the network 
for any abnormalities or in case of any anomalies). 

19. As to claims 12 and 29, Weber, Akagawa and Cooper discloses the invention 
substantially as in parent claims 1 and 18, including, wherein the nodes further 
comprise manageable entities (Weber, Fig. 15), the manageable entities responsive to 
the server, and further including storage entities, connectivity entities, and database 
entities (Weber, Fig.2, [0051], where server obviously will have storage, connectivity 
entities could be switches). 

20. As to claims 13 and 30, Weber, Akagawa and Cooper discloses the invention 
substantially as in parent claims 1 and 18, including, further comprising selectively 
suppressing events of a particular category and severity (Weber, [0199], where selected 
events type means selection can be made by category or events). 

21 . As to claims 1 7 and 34, Weber, Akagawa and Cooper discloses the invention 
substantially as in parent claims 1 and 18, including, receiving a user input 
corresponding to selection of at least one node entry from 

among the node entries displayed in the status array (Weber, Fig. 29, [0198], where use 
can click on the line item in the overview graphical user interface); 

displaying an expanded menu of status options for the selected entry (Weber, 
Fig. 29, [0198], where element-306 and 308 are expanded view); and 

receiving a response to the menus of status options and displaying an expanded 
status report corresponding to the expanded menu (Weber, Fig. 33, [0210]). 
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22. Claims 38-40 and 42, carry similar limitations as the parent claims 1,18, 35, 
37and 43, therefore are rejected under for same rationale. 

23. As to claim 44, Weber, Akagawa and Cooper discloses the invention 
substantially as in parent claim 43 above, including, the chart entries in the status array 
are further subdivided into chart entries directed to manageable entity health, 
manageable entity performance, and storage system capacity (Cooper, Fig. 20 and 
Fig. 21 , [0489], where disclosed is a high level reporting of the health of the monitored 
network and constructing a chart from given value is obvious and well know in the art, 
Further Fig. 20 displays the subdivided chart for network events which can be modified 
and customized as per requirement). 

24. Claims 14-15, 31-32 and 44 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Weber, Akagawa and Cooper in view of Manghirmalani et al (Patent 
Number: 5,819,028), hereinafter "Manghirmalani". 

25. As to claims 14 and 31 , Weber, Akagawa and Cooper discloses the invention 
substantially as in parent claims 1 and 18, including, wherein the chart entries in the 
status array are further subdivided into chart entries directed to manageable entity 
health (Weber, Fig. 29, [0195], where over all network performance monitor can be 
interpret as manageable entity health). Weber, Akagawa and Cooper are silent on 
disclosing explicitly, displaying storage capacity in the chart. However, Manghirmalani 
discloses, a system, which display network health, load and error (Manghirmalani, 
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Fig. 13 and 14, Col. 5, lines 39-50, where load, error and performance are shown in 
meter form and histogram as well and it will be obvious variation to represent the 
storage capacity in the chart form as well). 

Therefore, it would have been obvious to one ordinary skilled in the art at the 
time the invention was made to combine the teachings of Weber and Akagawa with the 
teachings of Manghirmalani in order to provide a system to monitor and interpret the 
behavior of network entities or domains in a manner that is specific, yet independent of 
the network entity. 

26. As to claims 15 and 32, Weber, Akagawa, Cooper and Manghirmalani discloses 
the invention substantially as in parent claims 1 and 18, including, receiving a selection 
of at least one node in a hierarchical arrangement of nodes (Manghirmalani, Fig. 2, 
Col. 5, lines 51-58, where corporate, field office 1,2 and 3 are hierarchical); 

and wherein receiving, aggregating, displaying a status array, and displaying, within at 
least one chart entry, node entries (Weber, Fig.29, [0195], where all feature are listed in 
tabular and chart forms) are performed in relation to the selected at least one node in 
order to display the simultaneous status of nodes in a network (Weber, Fig.29, [01 98], 
where at least one node is displayed in the chart). 

27. As to claim 44, Weber, Akagawa, Cooper and Manghirmalani discloses the 
invention substantially as in parent claim 43 above, including, the chart entries in the 
status array are further subdivided into chart entries directed to manageable entity 
health, manageable entity performance, and storage system capacity (Manghirmalani, 
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Fig. 13 and 14, where subdivided chart for network health, load, error and net Doctor is 
displayed, which comprehensively suggest that these charts can be modified as per 
admin preferences or can be customized in many ways). 

28. Claims 16 and 33 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Weber, Akagawa and Cooper in view of Beshai et al (Pub. No.: US 2004/0037558 
A1 ), hereinafter "Beshai". 

29. As to claims 16 and 33, Weber, Akagawa and Cooper discloses the invention 
substantially, including, 

i) a general alert chart entry displaying alert status of managed entities in the network 
(Weber, Fig.29, [0195]); 

ii) a storage chart entry indicating alert status of managed storage entities in the 
network (Manghirmalani, Fig. 13 and 14, Col.5, lines 39-50, where load, error and 
performance are shown in meter form and histogram as well and it will be obvious 
variation to represent the storage capacity in the chart form as well); 

iii) a host chart entry indicating alert status of managed host entities in the network 
(Cooper, Fig. 20, [0487], where dashboard-20000 is kept up to date with current 
monitoring information from the monitored network); and 

iv) a connectivity chart entry indicating alert status of managed connectivity entities in 
the network (Cooper, Fig. 23, where connectivity status and severity conditions are 
disclosed). Weber, Akagawa and Cooper however are silent on disclosing the status 
array in N by M matrix of the plurality of chart entries. 
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Beshai however, discloses arrays and matrices (Beshai, [0102], where state 
arrays and matrices are used for path allocation in network environment. 

Therefore, it would have been obvious to one ordinary skilled in the art at the 
time the invention was made to combine the teachings of Weber, Akagawa and Cooper 
with the teachings of Beshai in order to provide a node structure that permits scalability 
and can employ time-sharing techniques. 

Examiner's Note: Examiner has cited particular columns and line numbers in the 
references, as applied to the claims above for the convenience of the applicant. 
Although the specified citations are representative of the teachings of the art and are 
applied to the specific limitations within the individual claims, other passages and 
figures may apply as well. It is respectfully requested from the applicant in preparing 
responses, to fully consider the references in its entirety as potentially teaching of all or 
part of the claimed invention, as well as the context. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to TAUQIR HUSSAIN whose telephone number is 
(571)270-1247. The examiner can normally be reached on 7:30 AM to 5:00 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Bunjob Jaroenchonwanit can be reached on 571 272 3913. The fax phone 
number for the organization where this application or proceeding is assigned is 571- 
273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



IT. HJ 

Examiner, Art Unit 2152 

/Dohm Chankong/ 
Examiner, Art Unit 2152 



